0

I have some queries regarding AWS setup please clarify.

I have created a VPC with CIDR 172.16.0.0/16 which is a private range of IP's. In my route table, I routed all the traffic from this range. Below are my queries.

  • How IGW connects to the internet(As CIDR range is private)?
  • What is the IP range of EC2 instance in this scenario? Is it 172.16.x.x?
  • Is it possible to assign a public IP to an EC2 instance which is not in CIDR range?
  • How an Elastic IP impacts here?

Any help on these questions would be highly appreciated.

Thanks in advance.

2 Answers 2

2

The IP stack in the kernel of a running instance is only aware of the instance's private IP address.

The IGW is a 1:1 NAT device with a static map, which translates the instance's private IP to the instance's assigned public IP, if it has one, for traffic to/from the Internet. Configuration of the IGW is fully automatic. The IGW is not a physical device in a physical place. It's a logical entity whose functions are performed by the network infrastructure itself.

Instances without a public IP cannot be situated on a subnet whose default route is the IGW (called a "public subnet" because it is intended for use by instances with public IPs). Instead, they must be placed on a subnet whose default route points to a NAT Gateway or a NAT Instance (a "private subnet," intended for use by instances with only private IPs), so that their traffic can ultimately use the public IP address of that NAT device for outbound Internet access.

It is not possible to have an EC2 instance with a private IP address that is outside the CIDR range for the subnet where the instance is placed. If you change the IP address on the Ethernet interface of an instance, itself, the instance simply becomes inaccessible.

When an EC2 instance has a public IP, either because it was launched with one requested or launched on a subnet configured to assign them automatically, that address comes from a public pool and will go away when the instance is stopped or terminated and cannot be reclaimed. An EIP works the same way, during operations, except that it is allocated to your account until you release it, so it does no change if it is attached to an instance that is subsequently stopped. You are not billed for any EIP that is the first EIP attached to a running instance. Additional EIPs on the same machine, EIPs attached to a stopped instance, or EIPs attached to nothing, are subject to a charge.

1

When you say "I have routed all the traffic in this range" where have you routed it? That's a bit ambiguous. You can't route traffic in a VPC, you route traffic in / between subnets, the internet, and a few other places I'll skip over.

  1. An internet gateway (IGW) connects to the internet in a way AWS don't describe. It Just Works.

  2. You can't create an instance in a VPC unless you've created a subnet. If you create a single /16 subnet (which is really large, 65K hosts) then yes it's 172.16.x.x. If you create a subnet 172.16.0.0/24 then the IP will be 172.16.0.x.

  3. The VPC CIDR range is just for private IPs. AWS assigns a second IP either as a public IP or elastic IP. In general any server, AWS or not, can have many IPs.

  4. Question is ambiguous. See #3.

My general suggestion to you is to do a course such as AWS Architect Associate at Linux Academy or Cloud Guru to learn the basics of AWS VPCs before you try to use them commercially. Server Fault is a place for professionals with good IT knowledge to ask questions, rather than a place for beginners to ask question. SuperUser.com may be more suitable for these types of questions.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .